Decorator for role requirement in Flask - Step-by-Step Execution

Concept Flow - Decorator for role requirement

Define decorator function

↓

Decorator wraps target function

↓

On function call: Check user role

↓

Run function

↓

Function ends

The decorator wraps a function to check user roles before running it. If the user has the right role, the function runs; otherwise, access is denied.

Execution Sample

Flask

def role_required(role):
    def decorator(func):
        def wrapper(*args, **kwargs):
            if current_user.role == role:
                return func(*args, **kwargs)
            return 'Access Denied', 403
        return wrapper
    return decorator

This code defines a decorator that checks if the current user has the required role before running the decorated function.

Execution Table

Step	Action	Check	Result	Function Call Outcome
1	Call decorated function	N/A	Enter wrapper	Waiting for role check
2	Check current_user.role == 'admin'	current_user.role='admin'	True	Call original function
3	Original function runs	N/A	N/A	Returns function output
4	Call decorated function	N/A	Enter wrapper	Waiting for role check
5	Check current_user.role == 'admin'	current_user.role='guest'	False	Return 'Access Denied', 403

💡 Execution stops after returning function output or access denied response.

Variable Tracker

Variable	Start	After Step 2	After Step 5	Final
current_user.role	undefined	'admin'	'guest'	Depends on user
wrapper return	undefined	Function output	'Access Denied', 403	Depends on role check

Key Moments - 2 Insights

Why does the original function only run if the role matches?

Because the wrapper checks current_user.role before calling the original function (see execution_table step 2). If the check fails, it returns access denied instead.

What happens if the user role is not set or different?

The wrapper returns 'Access Denied', 403 immediately without running the original function (see execution_table step 5).

Visual Quiz - 3 Questions

Look at the execution_table, what is the outcome at step 3 when the role matches?

A The wrapper function exits without calling the original function

B Access Denied error is returned

C The original function runs and returns its output

D An exception is raised

💡 Hint

Check the 'Function Call Outcome' column at step 3 in execution_table

At which step does the role check fail and access is denied?

A Step 5

B Step 4

C Step 2

D Step 1

💡 Hint

Look at the 'Check' and 'Result' columns in execution_table rows for step 5

If current_user.role was 'admin' but the decorator required 'guest', what would happen?

A Function runs normally

B Access Denied is returned

C An error is raised

D The wrapper skips the role check

💡 Hint

Role must match exactly for function to run, see execution_table step 2 logic

Concept Snapshot

Decorator for role requirement:
- Define a decorator that takes a role string
- Inside, define a wrapper function
- Wrapper checks current_user.role against required role
- If match, call original function
- Else, return access denied response
- Use @role_required('role') above route functions

Full Transcript

This visual execution trace shows how a Flask decorator checks user roles before running a function. The decorator wraps the function and on each call, it compares the current user's role to the required role. If they match, the original function runs and returns its output. If not, the wrapper returns an 'Access Denied' message with a 403 status code. The execution table tracks each step: entering the wrapper, checking the role, and either running the function or denying access. The variable tracker shows how current_user.role and the wrapper's return value change during execution. Key moments clarify why the function only runs on role match and what happens if roles differ. The quiz tests understanding of these steps and outcomes. This pattern helps secure Flask routes by role-based access control.

Practice

1. What is the main purpose of a decorator that checks user roles in a Flask app?

easy

A. To log user activity without restrictions

B. To speed up the execution of functions

C. To change the user role dynamically

D. To restrict access to certain functions based on user roles

Solution

1. Step 1: Understand the role of decorators in Flask

   Decorators wrap functions to add extra behavior, like checking conditions before running the function.

2. Step 2: Identify the purpose of role checking

   Role checking ensures only users with the right permissions can access certain parts of the app.

3. Final Answer:

   To restrict access to certain functions based on user roles -> Option D

4. Quick Check:

   Role check decorator = restrict access [OK]

Hint: Decorators add checks before function runs [OK]

Common Mistakes:

• Thinking decorators change user roles
• Assuming decorators speed up code
• Confusing logging with access control

2. Which of the following is the correct syntax to define a decorator that requires a role named 'admin' in Flask?

easy

A. @require_role(admin)\ndef admin_panel():\n pass

B. def require_role('admin'):\n def admin_panel():\n pass

C. @require_role('admin')\ndef admin_panel():\n pass

D. @require_role['admin']\ndef admin_panel():\n pass

Solution

1. Step 1: Recognize decorator syntax in Python

   Decorators use @ followed by the decorator function call with parentheses if it takes arguments.

2. Step 2: Check correct argument passing

   The role name 'admin' must be passed as a string inside parentheses.

3. Final Answer:

   @require_role('admin')\ndef admin_panel():\n pass -> Option C

4. Quick Check:

   Decorator with parentheses and string argument = correct [OK]

Hint: Decorator with argument uses parentheses and quotes [OK]

Common Mistakes:

• Missing parentheses for decorator with arguments
• Passing role without quotes
• Using square brackets instead of parentheses

3. Given this decorator code snippet, what will be printed when a user with role 'user' tries to access the decorated function?

def require_role(role):
    def decorator(func):
        def wrapper(user_role):
            if user_role == role:
                return func()
            else:
                return 'Access Denied'
        return wrapper
    return decorator

@require_role('admin')
def secret_data():
    return 'Secret Info'

print(secret_data('user'))

medium

A. Secret Info

B. Access Denied

C. TypeError

D. None

Solution

1. Step 1: Understand the decorator logic

   The wrapper checks if the passed user_role matches the required role 'admin'. If yes, it calls the function; otherwise, returns 'Access Denied'.

2. Step 2: Analyze the function call with 'user' role

   The user_role 'user' does not match 'admin', so the wrapper returns 'Access Denied'.

3. Final Answer:

   Access Denied -> Option B

4. Quick Check:

   User role mismatch = Access Denied [OK]

Hint: Mismatch role returns 'Access Denied' [OK]

Common Mistakes:

• Assuming function runs regardless of role
• Confusing return values
• Ignoring wrapper function logic

4. Identify the error in this Flask role-checking decorator code:

def require_role(role):
    def decorator(func):
        def wrapper(*args, **kwargs):
            if current_user.role == role:
                func(*args, **kwargs)
            else:
                return 'Forbidden'
        return wrapper
    return decorator

medium

A. Missing return statement before func call inside wrapper

B. Incorrect use of *args and **kwargs

C. current_user.role should be current_user.roles

D. Decorator should not have nested functions

Solution

1. Step 1: Check the wrapper function's return behavior

   The wrapper calls func(*args, **kwargs) but does not return its result, so the decorated function returns None.

2. Step 2: Confirm correct fix

   Adding 'return' before func call ensures the wrapper returns the function's output properly.

3. Final Answer:

   Missing return statement before func call inside wrapper -> Option A

4. Quick Check:

   Always return function result in wrapper [OK]

Hint: Wrapper must return the wrapped function's result [OK]

Common Mistakes:

• Forgetting to return function output
• Misusing argument unpacking
• Incorrect attribute name for user role

5. You want to create a Flask decorator that allows access if the user role is either 'admin' or 'editor'. Which of these decorator implementations correctly achieves this?

hard

A. def require_roles(*roles):
def decorator(func):
def wrapper(user_role):
if user_role in roles:
return func()
return 'Access Denied'
return wrapper
return decorator

@require_roles('admin', 'editor')
def edit_page():
return 'Edit Page'

B. def require_roles(roles):
def decorator(func):
def wrapper(user_role):
if user_role == roles:
return func()
return 'Access Denied'
return wrapper
return decorator

@require_roles(['admin', 'editor'])
def edit_page():
return 'Edit Page'

C. def require_roles(*roles):
def decorator(func):
def wrapper(user_role):
if user_role == roles:
return func()
return 'Access Denied'
return wrapper
return decorator

@require_roles('admin', 'editor')
def edit_page():
return 'Edit Page'

D. def require_roles(roles):
def decorator(func):
def wrapper(user_role):
if user_role in roles:
func()
return 'Access Denied'
return wrapper
return decorator

@require_roles(['admin', 'editor'])
def edit_page():
return 'Edit Page'

Solution

1. Step 1: Understand how to accept multiple roles

   Using *roles collects multiple role arguments as a tuple, allowing easy membership checks.

2. Step 2: Check membership and return function result

   The wrapper checks if user_role is in roles and returns func() result; otherwise returns 'Access Denied'.

3. Final Answer:

   Implementation using *roles and 'in' check with return func() -> Option A

4. Quick Check:

   Use *args and 'in' for multiple roles [OK]

Hint: Use *args and 'in' to check multiple roles [OK]

Common Mistakes:

• Comparing user_role to tuple instead of membership
• Not returning function result
• Passing roles as list but comparing with == instead of 'in'